Feeds

Unlocking CryptoLocker: How infosec bods hunt the fiends behind it

Looks like 2013's nastiest cyber-threat is run from Eastern Europe - or Russia

Secure remote control for conventional and virtual desktops

CryptoLocker, the Bitcoin-hungry ransomware menace that has become 2013’s most infamous malware, was likely created by a single hacker crew in Russia or former Eastern bloc states and is heavily targeting US and UK systems, researchers have exclusively revealed to The Register.

Dell SecureWorks’ Counter Threat Unit (CTU) set up a sinkhole operation not long after the uber ransomware emerged in September, registering multiple domains from a pot of those used by CryptoLocker. Between October 22nd and November 1st, around 31,866 unique IP addresses contacted those CTU sinkhole servers, 22,360 from the US, 1,767 in the UK and 818 in India.

This provides a glimpse into the scourge that CryptoLocker has now become. But Keith Jarvis, a security researcher with Dell SecureWorks’ CTU, estimates the overall number of infected machines is now approximately 250,000.

“The actors infect machines in ‘waves’ so rates wax and wane between zero and around 5,000 a day,” he told El Reg.

Another Russian beastie?

Researchers have been rabidly delving through their CryptoLocker data in an attempt to determine its provenance. It first emerged in September, when early infections were found “disproportionately at financial institutions”, the CTU team said. Various industries have been targeted since then, from the hospitality sector to public utilities.

In the early days, the attackers solely went after businesses, sending out malicious ZIP archives in spam emails, but turned their attention to general PC owners soon enough.

Initial samples were downloaded from a server located in Missouri. Early versions included code to connect to an IP address located in a Phoenix NAP data centre in Arizona. The attackers have been hosting much of their activity on virtual private servers (VPS) located at different “bullet-proof” hosting providers across Russia and former Eastern bloc countries, who are either “indifferent to criminal activity on their networks or are complicit in its execution”, according to the CTU report.

This has led researchers to their suspicion that one gang of crooks based out of Eastern Europe or Russia are to blame.

“The majority of command and control servers hosting the CryptoLocker malware are located in the Russian Federation or the former Eastern bloc states, showing a knowledge of these infrastructure providers, and it is evident from the messages alerting the victims that English is not the CryptoLocker Group’s first language,” Jarvis added.

“This suggests that the threat actors behind CryptoLocker could be located somewhere in the Russian Federation or the former Eastern bloc states. Additionally, we have seen many hacker scams come out of this area of the world and target mainly English-speakers in the US and UK,” continued Jarvis. “We think it is wholly controlled and operated by a single crew, and not bought and sold on the underground.”

They’re using methods typical amongst Russian crooks, distributing it with the peer-to-peer (P2P) Gameover Zeus malware, in some cases via the Cutwail spam botnet or the Magnitude exploit kit.

Cryptolocker: In a class of its own

The reason why researchers are in such a spin about CryptoLocker is simple: it’s an advanced piece of ransomware, especially compared to the usual tripe that tells the user they’ve been caught doing nasty things and need to pay a fine. CryptoLocker follows through with its promise of encrypting users’ files, unlike other ransomware, and it does so with some finesse.

“This isn’t the first malware that destroys files, but it’s certainly in its own class,” Jarvis added.

Using the Microsoft CryptoAPI, Cryptolocker encrypts each file with a unique AES key, which is then encrypted with the RSA public key received from the crooks’ server. The malware has that public key, along with a small amount of metadata and the encrypted file contents, written back to disk, replacing the original files.

The only way to decrypt them is with the RSA private key held by the criminals, which can purportedly be acquired by handing over money, normally around 0.3 BTC. The CryptoLocker overlords also accept transfers over MoneyPak, another money transfer system.

Whilst some had suggested that payments did not result in decryption, victims have reported regaining access after coughing up. Sometimes, however, it takes weeks for the files to be unlocked. The crooks even created a “CryptoLocker Decryption Service” (see below) in early November, which gave people a chance to decrypt their docs even if they had not handed over the money before CryptoLocker’s ticking clock of doom hit 00:00. Early versions of this service charged 10 BTC, but then the value of a single bitcoin hit the $1000 mark, so the cost had to come down.

The masterminds have tried to avoid white hats by shifting around their C&C infrastructure. They’ve been using a domain generation algorithm (DGA) to create 1,000 potential command and control domain addresses per day, to be used alongside static servers for their villainous campaign. This dynamism appears to be working. Dell SecureWorks is now struggling to get meaningful stats from its sinkhole operation.

Cryptolocker won’t be disappearing in 2014. Indeed, it looks set to grow only larger – thanks to the wherewithal and technical nous of the gang behind it. ®

Intelligent flash storage arrays

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Free virtual appliance for wire data analytics
The ExtraHop Discovery Edition is a free virtual appliance will help you to discover the performance of your applications across the network, web, VDI, database, and storage tiers.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Website security in corporate America
Find out how you rank among other IT managers testing your website's vulnerabilities.